chore(wolf): checkpoint buglog.json (973 bugs)

.wolf/buglog.json

@@ -17533,6 +17533,26 @@
       ],
       "occurrences": 2,
       "last_seen": "2026-08-19T04:15:00Z"
+    },
+    {
+      "id": "bug-1592",
+      "timestamp": "2026-08-19T07:38:00Z",
+      "error_message": "grep/tail: Permission denied on $TOP/logs/xcecd.log after starting the real (production) xcecd worker via sudo",
+      "file": "src/worker/src/main.c",
+      "root_cause": "xcecd's main log file (config.log_file, opened by the logging library at daemon startup while running as root) is created with default umask perms (verified live: root:root, mode 640) and never chmod'd permissive -- unlike xcecd_worker.log (explicit open()+chmod(0666) at main.c:536-543) and the domain socket (chmod(config.domain_sock_file, 0666) at main.c:578). Any verification command (grep/tail/cat) run as the invoking non-root user against xcecd.log fails with Permission denied.",
+      "fix": "Documented as a known behavior in .claude/skills/xce-deploy-ha/SKILL.md: all log reads against the real worker's xcecd.log must be prefixed with sudo (sudo grep .../sudo tail ...), same as the sudo kill already required to stop the root-owned process. Not a code fix -- xcecd.log intentionally stays root-owned; only the skill's documented verification commands changed.",
+      "tags": [
+        "xce-deploy-ha",
+        "worker",
+        "xcecd",
+        "sudo",
+        "permissions",
+        "logging",
+        "real-worker"
+      ],
+      "related_bugs": [],
+      "occurrences": 1,
+      "last_seen": "2026-08-19T07:38:00Z"
     }
   ]
 }